The EU hit Meta with a record GDPR fine

A fine of EUR 1.2 billion (approx. HUF 450 billion). imposed data protection regulators of the European Union to Meta, because since July 2020, the company has transmitted user data to the United States in serious violation of the provisions of the EU General Data Protection Regulation (GDPR).

According to the main EU data protection regulatory authority, since Facebook also stored the personal data of European users on its servers in the United States, the American authorities could essentially access the data at will according to the local legal framework (FISA 702). The fine surpasses the previous record of 746 million euros imposed on Amazon in 2021 for data protection violations related to its advertising business.

In addition to imposing a fine, the decision also obliges Meta to stop sending information about European Facebook users to the United States and delete the data already sent within six months – although the Zuckerbergs can avoid all this if Washington agrees with the EU on the about enabling data transmission.

NIS2 Directive: compliance or radical transformation? (x) Come to our online meetup and learn everything about the new EU cyber security directive!

According to a 2020 EU court ruling, companies wishing to comply with the GDPR cannot rely on the previous data protection shield because it does not sufficiently protect user data against American surveillance. Last year, Meta threatened to withdraw from the EU if the Irish data protection watchdog banned the flow of data between the two parties.

In mid-April, the European Data Protection Board (EDPD), which brings together European data protection authorities, technically gave the Irish data protection authority, the Data Protection Commission (DPC), one month to finalize and announce the European operation of Facebook and Instagram social services in their current form. blocking decision. Last summer, after several months of back-and-forth, the Irish authorities prepared the draft decision, which primarily cracks down on the data management practices of Meta and its social services (Facebook, Instagram, Whatsapp) concerning EU citizens.

The case, which can be traced back to the failure of the two transatlantic data exchange agreements, apparently did not want to be resolved particularly quickly by the DPC, which made a decision on the case for the first time in September 2020, but due to various legal procedures, the implementation of its provisions has not taken place to date. The Irish authorities and Meta tried to play with delay so that by the time the decision of the Irish data protection authority goes through the bureaucratic EU legal system and courts, the new data exchange agreement between the EU and the United States, the third in a row, will be born, which has actually run out of purpose. does the whole procedure.

US President Joe Biden and Ursula Von Der Leyen, the President of the European Commission, announced at the NATO summit in Brussels at the end of March last year that an agreement had been reached on the details of the new transatlantic data exchange agreement, and that the drafting of the agreement is already underway, but contrary to expectations, it did not succeed last year – the parties announced in December that the new agreement, which is said to be able to dispel all the previous concerns of EU data protection organizations, could be completed in July this year.

However, the European Parliament recently found the non-final wording put forward by the Commission to be inadequate, so the new convention will almost certainly not be concluded until the summer break.